Since their Final Rule for Contract Year 2023, the Centers for Medicare and Medicaid Services (CMS) has implemented rules for third-party marketing organizations (TPMOs). Here are the requirements that impact your business.
The marketing and communication updates include:
- Defining TPMOs
- Necessitating use of a standard disclaimer both when the entities are marketing fewer than all plans available in a given geographical area and when the entities are marketing all plans available in a given geographical area
- Implementing new rules regarding plans’ oversight responsibilities
Listen to this article:
Here at Ritter Insurance Marketing, we know the importance of staying compliant. We strive to keep you up to date with any compliance changes, including call recording, marketing and event parameters, and more. These regulations pertain to agents, so let’s take a closer look at them so you can stay compliant!
What Are Third-Party Marketing Organizations?
CMS defines third-party marketing organizations (TPMOs) as “organizations that are compensated to perform lead generation, marketing, sales, and enrollment related functions as a part of the chain of enrollment.”
By this definition, CMS considers all insurance agents and brokers to be TPMOs; therefore, insurance agents and brokers must adhere to all CMS’ TPMO rules and guidelines.
What Do Agents/Brokers Need to Do as TPMOs?
Agents/brokers should follow the checklist below.
Add the TPMO disclaimer:
- To your website
- To your email communications
- Verbatim, to all your marketing materials, including print and TV ads
- To all sales calls within the first minute
When conducting lead-generating activities, disclose to the beneficiary that his or her information will be provided to a licensed insurance agent for future contact:
- Verbally when communicating with a beneficiary through the telephone.
- In writing when communicating with a beneficiary through mail or other paper communication.
- Electronically when communicating with a beneficiary through email, online chat, or other electronic messaging platform.
When conducting lead-generating activities, disclose to the beneficiary that he or she is being transferred to a licensed insurance agent who can enroll him or her into a new plan.
Do not share personal beneficiary data with other TPMOs unless prior express written consent is given by the beneficiary. Prior express written consent from the beneficiary to share the data and be contacted for marketing or enrollment purposes must be obtained through a clear and conspicuous disclosure that lists each entity receiving the data and allows the beneficiary to consent or reject to the sharing of their data with each individual TPMO.
Record calls (including video calls) with beneficiaries in their entirety. Call recording is limited to marketing, sales, and enrollment calls. “Marketing” includes retention marketing, aimed at influencing a beneficiary to stay enrolled in a current plan, and as well as the mention of any benefits (e.g., dental, vision, hearing, premium reduction, and cost savings).
Identify and make a list of all vendors, contractors, and subcontractors you use for marketing, sales, lead generation, and enrollment.
Revise your existing written agreements with all of your TPMOs (vendors, contractors, and subcontractors for marketing, sales, lead generation, and enrollment) to require your TPMOs to be compliant with TPMO regulations.
Enter into written agreements with all of your TPMOs (vendors, contractors, and subcontractors for marketing, sales, lead generation, and enrollment) with whom you have relationships but do not have written agreements that require the TPMOs to be compliant with TPMO requirements.
Develop a process for disclosing to the plans your vendors, contractors, and subcontractors you use for marketing, sales, lead generation, and enrollment. Your process should include a method for reporting changes to the list.
Disclose to the plans your vendors, contractors, and subcontractors for marketing, sales, lead generation, and enrollment.
Develop a process for reporting to plans monthly:
- Staff disciplinary actions associated with beneficiary interaction to the plan
- Violations of any requirements that apply to the plan associated with beneficiary interaction to the plan.
Report to plans monthly:
- Any staff disciplinary actions associated with beneficiary interaction to the plan.
- Violations of any requirements that apply to the plan associated with beneficiary interaction to the plan.
Must Get Written Consent to Share Client Data
According to the 2025 Final Rule, as of October 1, 2024, TPMOs may not sell or share personal beneficiary data with each other without obtaining prior express written consent from the beneficiary. CMS writes, “Individuals may be unaware that by placing a call or clicking on a generic-looking web link, they are unwittingly agreeing and providing consent for their personal beneficiary data to be collected and sold to other entities for future marketing activities.” Obtaining prior express written consent aims to curtail TPMOs selling and reselling personal data without the beneficiary realizing it.
Furthermore, the rule stipulates one-to-one consent, meaning that the consent you obtain is only good for the TPMO to which you’re sharing. Prior express written consent must be obtained through a clear and conspicuous disclosure that lists each entity receiving the data and allows the beneficiary to consent or reject to the sharing of their data with each individual TPMO. One generic, blanket written consent is not permitted.
The rule stipulates one-to-one consent, meaning that the consent you obtain is only good for the TPMO to which you’re sharing.
TPMOs must still obtain written consent even when sharing data to another legal entity under the same parent organization or to a downstream entity. CMS also requires obtaining written consent even when manually dialing leads to keep individuals from being called by TPMOs to whom they have not given permission to be called.
Read our full list of recommendations on sharing personal data compliantly in our post, Guidelines for Sharing Personal Beneficiary Data with Other TPMOs!
An exception to the rule is when a beneficiary can be connected to another TPMO in real time. A beneficiary may call an agent seeking information about Medicare plan options and that agent, to assist the beneficiary, may be able to transfer or connect that beneficiary to another agent during the call to provide real-time assistance.
When obtaining written consent, the disclosure you use must be transparent and prominently placed. At this time, there is not a standard CMS disclosure.
Important Disclaimers for Consideration
Here are the disclaimers you must consider using for your Medicare marketing materials:
TPMO Medicare FAQs
Is the TPMO Medicare disclaimer for agents required on materials created by the plan that I’m using and distributing to clients?
No. If the document was developed by the plan (e.g., Summary of Benefits) and you’re using it exactly as provided by the plan, the disclaimer is not required. However, if you alter the document, the disclaimer needs to appear.
Also, please note, the TPMO disclaimer is effective for all materials/sales interactions for enrollment effective dates of January 1, 2023, and beyond.
Does the TPMO disclaimer have a required location on written materials?
No. There is no specific requirements on where the TPMO disclaimer must be displayed on written materials (e.g., emails, letters, etc.) However, the disclaimer does need to be prominently displayed somewhere on actual materials.
What materials need updated with the TPMO disclaimer?
You should add the TPMO disclaimer to the following resources:
- Your website
- Electronically conveyed when communicating with a beneficiary through email, online chat, or other electronic means of communication
- Marketing materials, including print materials and television advertisements, developed, used or distributed by the TPMO
- Sales calls within the first minute
We recommend providing the TPMO disclaimer on all materials where it is possible to do so in a font that is easily read and understood by the recipient. Additionally, other disclaimers or marketing requirements may exist. If your business card contains nothing more than your contact information, we see little risk in omitting the disclaimer. Please refer to the Ritter Docs site for more information.
Is the TPMO disclaimer required to be included on a social media post marketing my business and including my phone number?
Yes. As specified by CMS, if a social media post is being used for and meets the definition of “marketing” (as noted in the Medicare Advantage Communication Requirements), the TPMO must include the disclaimer in the post. Additionally, other disclaimers or marketing requirements may exist. See the Ritter Docs site for more information.
Do agent marketing materials without MAPD/PDP plan premiums, cost-sharing or benefit information still need the TPMO disclaimer?
The TPMO disclaimer applies to all materials used that meet the definition of marketing. If the material does not include MAPD/PDP content or is not intended to be used for MAPD/PDP plan marketing, then the material does not require the TPMO disclaimer.
If I’m sharing lead data with my downlines, do I have to get written consent from the prospect first?
Yes. Even if you’re sharing personal beneficiary data within your agency, CMS still requires you to obtain express written consent. We recommend incorporating a disclosure and signature process into your current processes as much as possible.
Reporting of Non-Compliance
CMS requires MA plans and Part D sponsors to oversee and implement a mechanism of oversight of all agents, brokers, and other TPMOs who engage in sales and marketing of their plans. Sponsors must make this mechanism robust enough to record and report, at least monthly, to the sponsor’s CMS account manager any moderate to severe violations. Examples of these violations include, but are not limited to:
- Credentialing issues (e.g., licensing, appointment situations, testing requirements)
- Failure to comply with CMS’ marketing requirements (e.g., misleading information, cherry picking, unsolicited contact)
- Fraudulent enrollment practices (enrolling beneficiaries without consent)
- Repeat offenses, such as Scope of Appointment issues, lack of permission to contact documentation, and cross-selling inappropriately
We will continue to work hard bringing you the latest updates in compliance.
Have questions about these requirements? Please email [email protected].
Editor’s Note: This was originally published in August 2022. It has been updated to include information more relevant to 2024.
Not affiliated with or endorsed by Medicare or any government agency.
Share Post